<html>
<head><meta charset="utf-8"><title>potential semver related issue · t-cargo · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/index.html">t-cargo</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html">potential semver related issue</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="204522013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204522013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204522013">(Jul 21 2020 at 08:18)</a>:</h4>
<p>Hi all, a recent change in <code>ed25519-dalek</code> hilighted the fact that Cargo's semver comparison code doesn't correctly handle prereleases according to how semver states they should act, leading to <a href="https://github.com/dalek-cryptography/ed25519-dalek/issues/138">https://github.com/dalek-cryptography/ed25519-dalek/issues/138</a> -- is there anyone in the team who might be interested in helping me engage with deciding what the "right" answer here is?</p>



<a name="204523418"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204523418" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204523418">(Jul 21 2020 at 08:36)</a>:</h4>
<p><span class="user-mention" data-user-id="223910">@Daniel Silverstone</span> looking tangentially at the issue, and I <em>think</em> it misses pretty critical bit of info  -- what is the constraint in Cargo.toml?</p>



<a name="204523506"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204523506" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204523506">(Jul 21 2020 at 08:37)</a>:</h4>
<p><span class="user-mention" data-user-id="133169">@matklad</span> In this case I think it's <code>^1.0.0-pre.3</code></p>



<a name="204523596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204523596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204523596">(Jul 21 2020 at 08:38)</a>:</h4>
<p>Which, based on the "prereleases are incompatible with everything" would have to be equivalent to "=1.0.0-pre.3" if we were properly following semver</p>



<a name="204523861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204523861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204523861">(Jul 21 2020 at 08:42)</a>:</h4>
<p>Yup confirmed that <code>curve25519-dalek = "1.0.0-pre.3"</code> in Cargo.toml would download <code>-pre.4</code>.</p>



<a name="204524057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204524057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204524057">(Jul 21 2020 at 08:44)</a>:</h4>
<p>afaict, the presence of any prerelease indicators is supposed (in semver) to mean that <em>any</em> other version is incompatible.</p>



<a name="204524404"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204524404" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204524404">(Jul 21 2020 at 08:49)</a>:</h4>
<p>I think it is more nuanced than that (or can reasonable interpreted as such): pre-release means that semver guarantees are off. That is, by opting into per-releases, you agree that it's your job, as a user of a library, to deal with any incopat fallout</p>



<a name="204524731"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204524731" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204524731">(Jul 21 2020 at 08:52)</a>:</h4>
<p>Hmm, that's difficult to deal with when you're downstream of such a thing.  In this instance <code>rustup</code> depends on <code>pgp</code> which depends on <code>ed25519-dalek</code> which has now changed incompatibly.  I can't run <code>cargo update</code> without then failing to build a dependency of mine.  I kinda feel like <code>cargo update</code> shouldn't move pins with prereleases in them unless specifically asked to with <code>-p</code>, if we're not going to declare prereleases incompatible-with-everything.</p>



<a name="204524795"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204524795" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204524795">(Jul 21 2020 at 08:53)</a>:</h4>
<p>I'm trying to fit to the principle of least surprise.  It's surprising to me that cargo update would result in something which can't build, when semver is being followed by my indirect dependencies.</p>



<a name="204525251"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525251" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525251">(Jul 21 2020 at 08:58)</a>:</h4>
<p>Yeah, I wonder if the bug here is "cargo allows publishing crates with dependencies on <code>-pre</code> crates". Or maybe "Cargo allows to use <code>-pre</code> crates without opt-in from the top-level crate". Cargo forbids publishing with <code>= '*'</code> dependencies for similar reasons. </p>
<p>You can treat <code>pre</code> as semver compatible or semver incompatible (and I think both are correct, as the spec explicitely says that guarantess are off). </p>
<p>The latter is useful for people who use pre-release versions in production software (b/c they get more guarantees).</p>
<p>The former is useful to developers of the pre-release crates, because it gives wider testing for a pre-release.</p>



<a name="204525299"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525299" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525299">(Jul 21 2020 at 08:59)</a>:</h4>
<p>Perhaps it should be that cargo shouldn't allow publishing of a crate which doesn't use exact dependencies for anything with a prerelease marker?</p>



<a name="204525329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525329">(Jul 21 2020 at 09:00)</a>:</h4>
<p>So you can depend on it, but you have to use <code>=1.0.0-pre.3</code></p>



<a name="204525477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525477">(Jul 21 2020 at 09:01)</a>:</h4>
<p>I suppose it could be made more general as "it must be a constrained range" so as to permit the crate author to say "it's okay with <code>-pre.3</code> through to <code>-pre.5</code> but then if <code>-pre.6</code> is released, cargo won't automatically pick it up.</p>



<a name="204525481"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525481" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525481">(Jul 21 2020 at 09:01)</a>:</h4>
<p>That is another option. The drawback here is that mixing two deps which use pre.3 and pre.4 is now impossible, while most of the time you would actually expect pre.3 and pre.4 to be compatible in practice. But for pre versions that might be fine, as there are few pre versions in the crate graph, so probability of conflict is low</p>



<a name="204525597"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204525597" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204525597">(Jul 21 2020 at 09:03)</a>:</h4>
<p>Remember, prerelease also includes people using <code>-alpha.X</code> or <code>-beta.X</code> as well.  We'd be constraining the use of those partially as a result; but I think over-all it'd be far more sane.  If we're not able to make semver guarantees then we need to protect <em>downstream</em> users of the crate, and the onus should probably be on the crate declaring the dependency.</p>



<a name="204526457"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204526457" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> XAMPPRocky <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204526457">(Jul 21 2020 at 09:13)</a>:</h4>
<p>Would another solution be to make the prerelease number semver lite? If it was <code>-alpha.X.Y</code>? As to me reading the conversation it seems like there’s a desire to express when a prerelease is just a patch release or if there are breaking changes.</p>



<a name="204530041"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204530041" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204530041">(Jul 21 2020 at 10:02)</a>:</h4>
<p>I'm not sure we should attempt to place any meaning atop semver.  We already support multi-part prerelease components but don't treat them as anything other than forward compatible.  It's that treatment which needs thinking about.  if we continue to treat them as such then we need to warn (or error) on dependencies which specify/consume such version numbers.  Also I wonder, does Cargo think <code>1.0.1-pre1</code> is compatible with <code>1.0.0</code> ? because by semver's "no guarantees" I think it probably should not, since there are no guarantees.</p>



<a name="204543660"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204543660" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204543660">(Jul 21 2020 at 12:58)</a>:</h4>
<p>Side Note: Cargo needs to allow publishing a crate that depends on a pre-release crate because rust is broken into so many crates.</p>
<p>Example: winit (windowing lib) does a pre-release, so glutin (adds a GL context to a winit window) then needs to do a pre-release depending on the winit pre-release.</p>



<a name="204543769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204543769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204543769">(Jul 21 2020 at 12:59)</a>:</h4>
<p>The original issue is documented somewhere in the cargo issue tracker</p>



<a name="204543809"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204543809" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Eric Huss <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204543809">(Jul 21 2020 at 12:59)</a>:</h4>
<p>Using <code>=</code> requirements can be challenging, since it requires all crates to agree on exactly which release to use. For a single use crate, that is ok, but when shared it quickly becomes a problem. I think incompatibility between pre-release versions might just be in its nature. </p>
<p>There's more discussion at <a href="https://github.com/rust-lang/cargo/issues/2222">https://github.com/rust-lang/cargo/issues/2222</a> and <a href="https://github.com/rust-lang/cargo/issues/6016">https://github.com/rust-lang/cargo/issues/6016</a>. There hasn't been much work on what pre-release support actually means, but I believe because there isn't an obvious answer (or at least, a less-painful one than what currently happens).</p>
<p>Just roughly thinking of some improvements:</p>
<p><code>cargo update</code> could provide some warnings when transitive dependencies use pre-release versions. I'm not sure how annoying that would be.</p>
<p>Add an option to <code>cargo update</code> to forbid pre-release versions anywhere in the graph. Or conversely, an option to "opt-in" to pre-release versions.</p>
<p>public/private dependencies could be leveraged to decouple unification of private pre-release versions. For example, if <code>ed25519-dalek</code> is a purely private dependency of <code>pgp</code>, then it could use an <code>=</code> requirement without fear of it causing issues.</p>



<a name="204544083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204544083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204544083">(Jul 21 2020 at 13:01)</a>:</h4>
<p>What about only allowing pre-release dependencies when uploading to <a href="http://crate.io">crate.io</a> when the crate itself is a pre-release version?</p>



<a name="204544102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204544102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204544102">(Jul 21 2020 at 13:01)</a>:</h4>
<blockquote>
<p>cargo update could provide some warnings when transitive dependencies use pre-release versions. I'm not sure how annoying that would be.</p>
</blockquote>
<p>If we couple that with some flag/config options to suppress the warning, we'd get the "leaf crates opts-into pre-releases" behavior which is theoretically (but not necessary in practice) is the right one.</p>



<a name="204545323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204545323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204545323">(Jul 21 2020 at 13:12)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120518">Eric Huss</span> <a href="#narrow/stream/246057-t-cargo/topic/potential.20semver.20related.20issue/near/204543809">said</a>:</p>
<blockquote>
<p>Using <code>=</code> requirements can be challenging, since it requires all crates to agree on exactly which release to use.</p>
</blockquote>
<p>Why is that the only possible outcome? What prevents each one pulling in separate incompatible versions, the same as 1.0 and 2.0?</p>



<a name="204545414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204545414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204545414">(Jul 21 2020 at 13:13)</a>:</h4>
<p>I agree that if the crate is part of a public interface it makes things harder for people to use them together, but that's an existing problem outside of this (and ideally helped by public/private)</p>



<a name="204546914"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204546914" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Eric Huss <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204546914">(Jul 21 2020 at 13:27)</a>:</h4>
<p>I think it increases the risk that you'll have compilation errors or resolver errors due to attempting to mix distinct versions.</p>



<a name="204547192"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204547192" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204547192">(Jul 21 2020 at 13:30)</a>:</h4>
<p>Only if it's part of the crate's public API, yeah? Otherwise it should make crate resolving _more_ successful as there are less overall constraints.</p>



<a name="204547214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204547214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Silverstone <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204547214">(Jul 21 2020 at 13:30)</a>:</h4>
<p>So my issue is that <code>cargo update</code> in the rustup repo resulted in <code>pgp</code> not compiling.  Not that <code>rustup</code> didn't compile.</p>



<a name="204547413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/246057-t-cargo/topic/potential%20semver%20related%20issue/near/204547413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Eric Huss <a href="https://rust-lang.github.io/zulip_archive/stream/246057-t-cargo/topic/potential.20semver.20related.20issue.html#204547413">(Jul 21 2020 at 13:32)</a>:</h4>
<p>yea, only if it is public, or it uses <code>links</code>, or uses global symbols, etc.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>